ce262d6443018e7d79407db39d2f440cafbc3b651b43a1206aa8f970c124408e

Analysis

max time kernel
74s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 15:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d24bf6ab11da0e8801b212491d5f00f2_JaffaCakes118.html
Size

461KB
MD5

d24bf6ab11da0e8801b212491d5f00f2
SHA1

a3a8cedb4b513e0a6f84696bffa49ddfb99529b2
SHA256

ce262d6443018e7d79407db39d2f440cafbc3b651b43a1206aa8f970c124408e
SHA512

04591518cdbb81ab4fb15c81f7fa2b2affaf92fbcd648d7aff6589de80e1db6fcf8b2205198a4f9f4510736c246d2dc6c02ec864aeb8ab95bd4a2f58faa99211
SSDEEP

6144:SvsMYod+X3oI+YPsMYod+X3oI+YssMYod+X3oI+YLsMYod+X3oI+YQ:k5d+X395d+X305d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{570C7511-6D31-11EF-80EF-5A85C185DB3E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000c79915b6df7b330522416f9105040a590d145acc927febf57958c1c1ec269e77000000000e80000000020000200000003c4f9312dd6295379a2e2ce147429808a6b60254debafe6d34ba22cf42426ec620000000c6ba9aa2be8ab5f5099db1547463b6133c66ad280ddbb8af384a005bb44f8181400000000c6f5dc23c4a381e79aa3c4074dc59aa13e43dcca4f52d18ad50dcf6876abee0f2573650e4e9aa733b892fb303b2d0bd62e2536faf359212c92fcf22313d4173	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431886290"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0a014303e01db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000009925d78de5f602a2a73173336bd8f68d0d46a6503767e1d309d38e22450c3996000000000e80000000020000200000008a4f6ee37d98916080b58967dd5d78f315c9b707e9927a2bc5b2dbee582fbbb790000000fb72f41575c515af188e35a524a2743836d9c740f6701ea2f28f743d587d51a051fa1dc30bea3ad07ec0e1e0fb173ac2d7b41c4d4e6f16c0dd176d8bb1d492155e69df1c537a15f2d142918808f768f454d4aaf0967c6c47485cfc2ad1876091bb1c8d6bab75d3b383fb0aa8abe250f671741db74ebd82918f375a5d0101a726f5da9c0e0f0411ef3a85e681108e39ec400000005a7db6f804f23949d2f30c17f9e572090419ef93086365cb75b2369b10a0fc5ad01c1ed995f070517a2c82e27496bb61837263e99587ce5a78644d4f75ddfb3b	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1688	iexplore.exe
1688	iexplore.exe
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2848	1688	iexplore.exe	30
PID 1688 wrote to memory of 2848	1688	iexplore.exe	30
PID 1688 wrote to memory of 2848	1688	iexplore.exe	30
PID 1688 wrote to memory of 2848	1688	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d24bf6ab11da0e8801b212491d5f00f2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1688 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ea7c3deec3e197ebc8cd2c96fed2ce3

SHA1
dde7ac5037bff74fc37c557f8b07da3923ce5751

SHA256
251e457fca5ddc84dafabddbbfd874f2957dfc6b4ca2333a25306f96863d84e3

SHA512
8e95919e8ec2461fc3a0f19ba77bcb4780f6e32408b971ac23dcde42e2200439147d343c40e3392db2b2c4cec74c110bc87872e9b24b9bbba4b0800d5d5c775f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8808515e1722aaf189656c4e0686e971

SHA1
2cbb9ab4eba2483350e5a6f34b2b69c5287a584b

SHA256
39b0192ac89d4d3401c6daedc461721cf7ae5dc8ddf10e7ff20436ce9e42f414

SHA512
97eb8910f8587ac317c33187520fc520201447548036ff39f2fafd35c5f825a1ae2bcb294e51ebcb6faa92835bbcacb020251593d7a32a1d24af8235f69e6245

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4722ded2e87fa996f6318d9b0beb473e

SHA1
35b41e14181e92350d594c7cecc63583998169ad

SHA256
b24803a5e7fde7e4baac950b1619b5960d20ff474c01c93478bae0354c7b2ddb

SHA512
d7d40ae9f80fdfca34b3caafcfafe923da1df47e5100626a53af3e2213d27cc01323ad12dea5728b3f1748b3915c43641319ab8757ade8577afa66c47cf416f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9dd292f0283cf601459d705dbef85eb8

SHA1
6a7054f78d087076e2356a629aed6b96ff068c12

SHA256
938c579305b6c42cf5d40c358358c37f043d38f70d94c9d1830d9e884f942433

SHA512
1933243f689f2b2581b9700c6a80289812c5c105bb3752344b947dd17d954a08778892e2526bbae6c1e74181c9045686c90d43cd10c077e6890c0f65210f3058

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32bf1152a6f6e1472404af7b7641976a

SHA1
411bcc980f59b220ff2fb333c12aeb1c2af23168

SHA256
6a8c9cf0e04f51513dd5b14d061df3585a8f9bed801d72e0be9e73c28e813b75

SHA512
54f4815144ce181f479fd3254deb129ecf2b620908017a7a3b144b19cc2b5c768d56a95686369cbc08f9e1461d6477bcf0a24a9cd272ae1c558f711d314fce08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c65ad6bb440e004dc40adf83f2375144

SHA1
143fc039888d1b00b0aa430de51d7bcd245f9c85

SHA256
3dee43727448c6ea557a6356097069b9a0311deca6ef3c5c4ef7e18c0e013692

SHA512
b5972d6e3e9e1ed3b393383bbd946d87baadf7c4ac2d692edeeb261d3c697af12afe70059c29ce27077467bc359cf30ce6d353e3440fc4888e94dd7b730e2f62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b044b583abd5733790a3b2ed628ebdb1

SHA1
94bbf02d4825b1caeeba40ef40bb212077f94707

SHA256
2239311205f6a8d12198ec447c9c273c80986a2e0806e7e0c20d1ebf73b70aad

SHA512
fc716a899c04a934c1f310fa79edb133f14a8c89c3f6e678173f20849e34ed21ab534b2cecb437de0442d70b580d1039d145ad23306cee899ea74c3431d7baf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
507b74428754b74c0457d09f14b26af4

SHA1
2b72957ac60a4cfedb9480a18f99e4f00c999535

SHA256
9564161f7d9f5f43e78da42c43c16f35131c61cf8c45d797b895fd7355b3a5f7

SHA512
b5ba9de755477fb40767ea116297304f72eff903b51675c69383b98a08f0a88330e51aab88a0f9c01cfb0dd3bdfe2400c6d486999f8b0d9eb1fceb514658fe5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c86551e663cf87bab15c3b87e5b31ad

SHA1
23828b172defb1c940e543d4201066a7b9a30d36

SHA256
5107c7708d16223126c9f6d2b9d17cf87dc4a6bfecc8c598cc4f976729cd319c

SHA512
f6d22aa617297c342dd5112209f7043902ce245a49d15b0106ada4b10c5c85ca1164cf1ec930a0292584e4e99b7c0af3a03dd6ee7da95f93ad51fecaaa8e9833

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97569a00155329a70640c737667d1060

SHA1
2f372785a242339063202a5a62c0b62b1522c63c

SHA256
fd6025ef11fbf51401179f713bb705720e25696338adece41d4c83bf4309466f

SHA512
3c8c4585275b694b2a5c45d1d08215153fee82ed9c13d8125fb10ad7a6f7c768f31ed85e77a899017c4521b41eb601097f28f15c4c4c9e94a9df786602e4f6a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3467a37dec69e40cba638e390ff2e535

SHA1
af14da7303d675effa03f2bd5f9b88ee2bff0fbb

SHA256
cd853320e505d42477c074deeffd8140718680eefab551e2ec7b509e38243899

SHA512
20c16b67b30310ffc4cd6e83e5e7057f5619aa5910a858cd06f6de7a6bdcaeca85bb0ba4adcd02f903e7be693348f74663f4b9ec85da093cee8dc6b0b3ef67f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b740ad7e5f39e9554fb431bdd16c2963

SHA1
3b4c261a1211eb6abaa174a204ba8d6b9bc27b68

SHA256
1fea8774bad4269b881aed5af79d94bf6722a2cd291541625af69c201ff8a777

SHA512
75cabd9213f46f5b4af5f7cc0390fb21de97a9ce780ceeb782e16511102d78e878b3687235ca7e0e844884bb5ae1b96c429d4e26528492016b19fb3bf04db978

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC0A4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC153.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit